[arch-security] [ASA-201511-6] powerdns: denial of service
anthraxx at archlinux.org
Thu Nov 12 00:20:07 UTC 2015
Arch Linux Security Advisory ASA-201511-6
Date : 2015-11-12
CVE-ID : CVE-2015-5311
Package : powerdns
Type : denial of service
Remote : Yes
Link : https://wiki.archlinux.org/index.php/CVE
The package powerdns before version 3.4.7-1 is vulnerable to denial of
Upgrade to 3.4.7-1.
# pacman -Syu "powerdns>=3.4.7-1"
The problems have been fixed upstream in version 3.4.7.
When the PowerDNS Authoritative Server is run inside the guardian
(--guardian), or inside a supervisor like supervisord or systemd, it
will be automatically restarted, limiting the impact to a somewhat
This bug was found using afl-fuzz in the packet parsing code. This bug,
when exploited, causes an assertion error and consequent termination of
the the pdns_server process, causing a denial-of-service.
A remote attacker is able to send specially crafted query packets to
crash the powerdns server process, causing a denial-of-service.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 819 bytes
Desc: OpenPGP digital signature
More information about the arch-security